[webkit-changes] [WebKit/WebKit] 0c5f00: [JSC] Array.from fast path should only handle pure...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 0c5f00d27cc29dd971cbd7c963dd36c0906693c1
      https://github.com/WebKit/WebKit/commit/0c5f00d27cc29dd971cbd7c963dd36c0906693c1
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2023-12-08 (Fri, 08 Dec 2023)

  Changed paths:
    A JSTests/stress/array-from-prototype.js
    M Source/JavaScriptCore/runtime/ArrayPrototype.cpp

  Log Message:
  -----------
  [JSC] Array.from fast path should only handle pure JSArray
https://bugs.webkit.org/show_bug.cgi?id=266053
rdar://119341126

Reviewed by Mark Lam.

DerivedArray can have IndexingType == NoIndexingShape JSArray. This patch limits Array.from fast path only for pure JSArray (by using isJSArray check).
Also, as an extra guard (and make it explicit for readability), we also add a code using slow path when IndexingType is ArrayClass (this means NoIndexingShape).

* JSTests/stress/array-from-prototype.js: Added.
* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):

Canonical link: https://commits.webkit.org/271720@main